Overview

overview

10

Static

static

10

066152bccc...8c.exe

windows7_x64

10

066152bccc...8c.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    066152bccc13ecc64c90f7fd586f0474e4c9b8c7d806d184e7928f174742a08c

  • Size

    80KB

  • Sample

    220212-mrl2madabj

  • MD5

    69f088acdf1f94ea72b64a59120e3e7d

  • SHA1

    789aba8de5062f0d21de2a21dddec81aab323897

  • SHA256

    066152bccc13ecc64c90f7fd586f0474e4c9b8c7d806d184e7928f174742a08c

  • SHA512

    1bcbfe1b5a345c039ad65fb029d59fbb63a8ed8911a79ce69f865943770ec44b6289a331f672cf6fb3c4b3e55590bf4bddee08cc92dbd2e307e2f833d72c9b0b

Score
10/10
sakulapersistencerattrojan

Malware Config

Targets

    • Target

      066152bccc13ecc64c90f7fd586f0474e4c9b8c7d806d184e7928f174742a08c

    • Size

      80KB

    • MD5

      69f088acdf1f94ea72b64a59120e3e7d

    • SHA1

      789aba8de5062f0d21de2a21dddec81aab323897

    • SHA256

      066152bccc13ecc64c90f7fd586f0474e4c9b8c7d806d184e7928f174742a08c

    • SHA512

      1bcbfe1b5a345c039ad65fb029d59fbb63a8ed8911a79ce69f865943770ec44b6289a331f672cf6fb3c4b3e55590bf4bddee08cc92dbd2e307e2f833d72c9b0b

    Score
    10/10
    sakulapersistencerattrojan

    • Sakula

      Sakula is a remote access trojan with various capabilities.

      trojanratsakula

    • Sakula Payload

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks